SSLPeerUnverifiedException while using self signed SSL certificate

Question

I have create a slef-signed SSL certificate for testing purpose. It works fine when I open https://localhost from browser and now I am following this guide for adding my own TrustManager in Android.

When I try to connect to server using IP address of my machine it throws

javax.net.ssl.SSLPeerUnverifiedException: Hostname 192.168.10.3 not verified:

While I was able to solve it using HostnameVerifier

HostnameVerifier hostnameVerifier = new HostnameVerifier() {
    @Override
    public boolean verify(String hostname, SSLSession session) {
        HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier();
        return hostname.trim().equals("192.168.10.3") || hv.verify(hostname, session);
    }
};   

but still I want to know what am I missing here? Am I still configuring it properly by using custom HostnameVerifier? Here is the output of my certificate

I/System.out: ca=C=PK, L=Islamabad, O=Self, OID.1.2.840.113549.1.9.1=#16176D616C6C617564696E71617A6940676D61696C2E636F6D, CN=https://192.168.10.3

I am running openssl server by using following command

openssl s_server -key rsa.key -cert allaudin.pem -accept 4000 -WWW

Answer 1

You can using Alternative Names for IP Address in self-signed SSL Certificate file.

There is a bash file that I have wrote on github to generate self-signed certificate within alternative names, you can copy the openssl.cnf and customize your openssl config. if want to using an existing private key, the bash file should be this:

#!/bin/bash
KEY_FILE="server.key"
#######################################################
## Remove all generated files                        ##
#######################################################

rm -f  server.crt keystore.p12 keystore.jks

#######################################################
## generate x509 certificate                         ##
#######################################################

openssl req -new -x509 -key $KEY_FILE -sha256 -out server.crt -days 730 -config openssl.cnf
openssl x509 -in server.crt -text -noout

#######################################################
## adding self-signed certificate into jks key store ##
#######################################################

PASSWORD="password"
openssl pkcs12 -export -name test -in server.crt -inkey $KEY_FILE -out keystore.p12 -password "pass:$PASSWORD"
keytool -importkeystore -destkeystore keystore.jks -srckeystore keystore.p12 -srcstorepass $PASSWORD -srcstoretype pkcs12 -alias test -storepass $PASSWORD

#######################################################
## Remove pkcs12 keystore                            ##
#######################################################
rm -f keystore.p12

using openssl x509 -in **.crt -text -noout to see whether having alternative names in self-signed certificate file. the alternative names in server.crt are:

X509v3 Subject Alternative Name:
        IP Address:127.0.0.1

AND having a TestCase according to Android unknown certificate authority has been wrote in java8 & junit5, if you want to test in Android you need make some transformations.